What’s Vulnerable › Vulnerabilities
CVE-2021-29425: Possible limited path traversal vulnerabily in Apache Commons IO
- Severity: medium (CVSS 4.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 10.5% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2021-04-13 · updated 2026-10-07
- Weakness: CWE-20
Description
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.
Affected products
- Apache Commons Io: 2.2, 2.3, 2.4, 2.5, 2.6
- Debian Linux: 9.0
- Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
- Oracle Corporation Oracle Access Manager: 11.1.2.3.0, 12.2.1.3.0, 12.2.1.4.0
- Oracle Corporation Oracle Agile Engineering Data Management: 6.2.1.0
- Oracle Corporation Oracle Agile PLM: 9.3.6
- Oracle Corporation APM - Application Performance Management: 13.4.1.0, 13.5.1.0
- Oracle Corporation Oracle Application Testing Suite: 13.3.0.1
- Oracle Banking Apis: 18.1, 18.2, 18.3, 19.1, 19.2, 20.1 (+1)
- Oracle Corporation Banking Digital Experience: 17.2, 18.1, 18.3, 19.1, 19.2, 20.1 (+1)
- Oracle Banking Enterprise Default Management: 2.6.2, 2.7.0, 2.7.1, 2.10.0, 2.12.0
- Oracle Banking Enterprise Default Managment: from 2.3.0 through 2.4.0
- Oracle Banking Party Management: 2.7.0
- Oracle Banking Platform: from 2.3.0 through 2.4.1; 2.6.2, 2.7.0, 2.7.1
- Oracle Blockchain Platform: before 21.1.2 — fixed in 21.1.2
- Oracle Corporation Oracle Commerce Guided Search / Oracle Commerce Experience Manager: 11.3.2
- Oracle Communications Application Session Controller: 3.9.0
- Oracle Corporation Oracle Communications BRM - Elastic Charging Engine: 11.3, 12.0
- Oracle Communications Cloud Native Core Network Repository Function: 1.14.0
- Oracle Communications Cloud Native Core Policy: 1.14.0
- Oracle Communications Cloud Native Core Unified Data Repository: 1.4.0
- Oracle Communications Contacts Server: 8.0.0.6.0
- Oracle Communications Converged Application Server - Service Controller: 6.2
- Oracle Corporation Communications Convergence: 3.0.2.2.0
- Oracle Communications Design Studio: from 7.4.0 through 7.4.2; 7.3.5
- Oracle Communications Diameter Intelligence Hub: from 8.0.0 through 8.1.0; from 8.2.0 through 8.2.3
- Oracle Corporation Communications Interactive Session Recorder: 6.3, 6.4
- Oracle Communications Offline Mediation Controller: 12.0.0.3
- Oracle Corporation Oracle Communications Order and Service Management: 7.3, 7.4
- Oracle Corporation Communications Policy Management: 12.5.0.0.0
How to fix
Upgrade to a fixed version: Oracle Blockchain Platform 21.1.2; Oracle Corporation OSS Support Tools 2.12.42; Oracle Corporation Oracle REST Data Services 21.2. Check the vendor advisory for mitigations.
References
- https://issues.apache.org/jira/browse/IO-556
- https://lists.apache.org/thread.html/r01b4a1fcdf3311c936ce33d75a9398b6c255f00c1a2f312ac21effe1%40%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r0bfa8f7921abdfae788b1f076a12f73a92c93cc0a6e1083bce0027c5%40%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r0d73e2071d1f1afe1a15da14c5b6feb2cf17e3871168d5a3c8451436%40%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r1c2f4683c35696cf6f863e3c107e37ec41305b1930dd40c17260de71%40%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r20416f39ca7f7344e7d76fe4d7063bb1d91ad106926626e7e83fb346%40%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r2345b49dbffa8a5c3c589c082fe39228a2c1d14f11b96c523da701db%40%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r27b1eedda37468256c4bb768fde1e8b79b37ec975cbbfd0d65a7ac34%40%3Cdev.myfaces.apache.org%3E
- https://lists.apache.org/thread.html/r2bc986a070457daca457a54fe71ee09d2584c24dc262336ca32b6a19%40%3Cdev.creadur.apache.org%3E
- https://lists.apache.org/thread.html/r2df50af2641d38f432ef025cd2ba5858215cc0cf3fc10396a674ad2e%40%3Cpluto-scm.portals.apache.org%3E
- https://lists.apache.org/thread.html/r345330b7858304938b7b8029d02537a116d75265a598c98fa333504a%40%3Cdev.creadur.apache.org%3E
Get alerted when CVE-2021-29425 or the next vulnerability affects your stack